Endpoint detection for Windows, Linux, and macOS. Sigma, YARA, and IOC rules on native telemetry. Written in Rust. No cloud account required.
- blue-team
- detection-engineering
- edr
- endpoint-detection
Repository Index
59,621 visible repositories in the index
1–4 of 4 · Most stars
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Read-only check for traces of the November 2026 NIKKE PC launcher compromise. Windows, Linux (Proton, Steam Deck) and macOS.
- iced
- incident-response
- indicators-of-compromise
- infostealer
Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.